All posts by cryptosmith

Writer, educator, and consultant in cybersecurity; author of three books.

WPA2 Packet Frame Format

Wireless Protected Access, Version 2 (WPA2) is the version of Wi-Fi security used in most cases today. This diagram illustrates the general layout of the security data used by WPA2. There’s a new version coming out, WPA3, but it doesn’t seem to be in any products yet.

I put this diagram together several years ago for my textbook. I recently performed a web search for similar diagrams only to realize that there aren’t any posted.

Continue reading WPA2 Packet Frame Format

Authentication Chapters Online

book cover - Authentication from Passwords to Public Keys

Thanks to my former publisher, Addison-Wesley nee-Pearson Education, I can post several chapters of my favorite writing project: Authentication: From Passwords to Public Keys. I’m including these chapters as material for the Cloud Cybersecurity course I’m doing at the University of Minnesota for Coursera.

The book was published in 2001, and it’s based on solid, well-documented technical concepts. Everything is sourced through the “Notes” and “Bibliography” sections. Authentication captures the 2001 technologies very thoroughly. For many people, that’s as much authentication technology as they ever see.

Continue reading Authentication Chapters Online

The practical digital library updated

Library bookcaseA few years ago I moved my private library to the cloud. It uses Calibre to catalog my books, and the Open Publication Distribution System (OPDS) to provide an Internet-capable catalog. OPDS is built in to a lot of publisher-independent e-reader software. My e-readers can generally retrieve books from Internet hosts that provide OPDS.

My latest library uses COPS to construct the OPDS catalog from my Calibre database (book list). I update my library by keeping a copy of my Calibre database and directory of book files on a web server.

Continue reading The practical digital library updated

Ross Anderson and another edition of Security Engineering

Security Engineering, by Ross AndersonEvery cybersecurity professional knows – and almost certainly owns – this book. Ross Anderson published the first edition back around 2001. He’s starting a third edition and is using an on-line collaborative model for developing revisions. He has already posted drafts of a few revised chapters.

Ross recently pointed out a disappointing result from Edward Snowden’s releases of NSA classified documents: most published analysis has been reportage. No one has done a “deep dive” into the technical aspets of what was released. This would probably still be of technical interest. It astonishes me every day how, despite perceived ongoing radical improvements in technology, things don’t really change that much.

A Forged “From” Address

Email with a forged FROM addressTo the left we see part of a malicious email. The author brags about how the From address is the same as the To address. This is supposed to mean that the author has broken into my email account.

I have been waiting patiently for someone to mail one of these to me. Now I can use it as an example. I’ll show you how to uncover it as a fraud.

Continue reading A Forged “From” Address

This photo should not exist

pin.it/fnnc4j6fjamugy

Once we get past the creep factor of Nazi army uniforms, we see a communications team sending a secret message. They are using the legendary Enigma machine to encrypt the message.

But why, why did that officer allow a photographer to record this highly sensitive activity?

A failure of operational security (OPSEC). Allies in Bletchley Park would have sacrificed lives for this photo, or any photo showing the device in operation.

Continue reading This photo should not exist